docs: the 2026-10-28 drift review; the plan, status and docs brought to date

The planning session read plan/served.md, every design document and the
five branches the owner paused on 2026-10-27 against main (44ee4083),
with dry-run merges touching no branch. plan/2026-10-28_DRIFT_REPORT.md
lists every divergence and judges every recorded departure (all kept;
three owed back; one needs a decision: P6 made ledger-store depend on
ledger-import).

The plan: section 0 "What changed on 2026-10-28"; 8.0.1 and the unit
Status lines name S4.4, S5, S6, S7 and P6 as built but unmerged; 8.0.2
records the destination (D-56: the installed app, P11a starts now) and
the resume order with the known conflicts (the shared documents.rs
test file, the types.rs appends, P6 retaking schema 18, the law numbers
34 to 37); 8.0.3 lists the names the EM approved during the wave; P11a
gains step 0 (the macOS and Windows keyring stores, the Windows data
root and pipes, a cross-platform CI build: today the agent path runs on
Linux alone); Q-5 is due and Q-8 asks whether D-47 to D-54 stand; the
Landlock sentences in section 2 and server.toml are struck.

STATUS.md and HANDOFF.md say where things stand and how to resume;
roadmap.md and gui.md are rewritten to today. The docs lose their
stale facts: 122 tools, 2,700 tests, the parity floor at 21 with the
P4b notes the slices never wrote, the ten crates and their dependency
graph (jiff added to the core's allowed list), the cutover of
2026-10-20 recorded in capability-parity.md and parallel-run.md, the
P4b S1 law and its two Kani harnesses added to verification.md (law
34), the proof counts (51 and 9), and README, the site and install.sh
honest about macOS (the viewer runs; connecting an agent waits for
P11a's keyring store, and the installer now says so instead of failing).

just check on main at 44ee4083: exit 0 (167 suites, 2,871 passed, 0
failed, 7 ignored, the server-only build clean). No code changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

docs/oracle.md

@@ -53,7 +53,7 @@ case: partial first/final months in different-length calendar months don't
 complement, so the lifetime total drifted by cents (fixed with the
 final-month true-up in `depreciation_schedule`).
 
-**Layer 3 — Mutation testing (live now).** `cargo mutants -p ledger-core`
+**Layer 3 — Mutation testing (paused for development until P12, D-33, 2026-10-20; CI's weekly shards still run).** `cargo mutants -p ledger-core`
 (228 mutants as of 2026-10-10: 159 caught, 28 unviable, 2 timeouts from
 induced infinite loops, 39 missed). Every *missed* mutant is triaged:
 real gaps get new tests (this pass added parent-account validation,
@@ -94,12 +94,11 @@ built through wanderbooks (entries, foreign lines, reversals, closes),
 every account's balance at month ends and random dates, and each month's
 P&L, compared exactly (15,800 comparisons). Its first run found one real
 difference, adjudicated from principles: wanderbooks kept sub-cent
-amounts on foreign lines; it now books in cents (rules.md B-3). The
-original plan follows. A
-`ledger-oracle` crate will run fixture books through our engine and through
-other implementations (GnuCash headless first), then diff `snapshot()`
-output automatically: `cargo xtask oracle`. This is the direct analog of
-storytold's `cargo xtask corpus` / `oracle_diff`, with one difference: a
+amounts on foreign lines; it now books in cents (rules.md B-3). What the
+original plan still owes (roadmap phase 3): fixture books, not only random
+ones, diffed as `snapshot()` output automatically, inside the harness as
+it is (no `ledger-oracle` crate is planned: D-53). This is the direct analog
+of storytold's `cargo xtask corpus` / `oracle_diff`, with one difference: a
 diff does not mean we are wrong. Each one is adjudicated from principles
 (see "Who is right"). Note also: GnuCash is *a* behavioral cross-check, not
 a file-format target
@@ -113,8 +112,10 @@ evidence. It never overrides them.
 ## What the oracle does NOT cover (yet)
 
 - **Workflows**, only semantics: that an invoice *posts the right lines* is
-  oracle-covered; that the invoice *screen* is usable is a UI concern for the
-  egui phase, where storytold's screenshot-in-the-loop comes back.
+  oracle-covered; that the invoice *screen* is usable is the viewer's
+  concern (since 2026-10-12: `crates/ledger-gui/tests/*.rs` render every
+  page with `shot(..)` and `tests/view_model.rs` holds every figure shown
+  to the engine's).
 - **Tax law.** The engine computes what you tell it; it does not know the
   tax code. Tax-adjacent logic gets its own fixtures and its own goldens
   when it arrives, sourced from IRS publications — never from memory.